diff --git a/backend/crossdomain/plugin/model/plugin_manifest.go b/backend/crossdomain/plugin/model/plugin_manifest.go
index 587e4b0a5a..993382592f 100644
--- a/backend/crossdomain/plugin/model/plugin_manifest.go
+++ b/backend/crossdomain/plugin/model/plugin_manifest.go
@@ -117,6 +117,10 @@ func (mf *PluginManifest) Validate(skipAuthPayload bool) (err error) {
 		return errorx.New(errno.ErrPluginInvalidManifest, errorx.KVf(errno.PluginMsgKey,
 			"invalid api type '%s'", mf.API.Type))
 	}
+	if mf.Auth == nil {
+		return errorx.New(errno.ErrPluginInvalidManifest, errorx.KV(errno.PluginMsgKey,
+			"auth is required"))
+	}
 	// auth.type=none,return nil
 	if mf.Auth.Type == consts.AuthzTypeOfNone {
 		return nil